Can you explain the 2FA risk?
If I'm fishing you and get you to type your password into fakegoogle.com, I'll try to use it with real google immediately. If they send me a 2FA error (and I've got a semi-sophisticated phishing operation) fakegoogle will show you a an input field for that 6 digit code (just like real google). Then I've got a few seconds to send that to $site as well. It's a tighter timing window, but it's likely at this point that I'm into your account.
This sort of attack isn't possible with a hardware key, since it only works on the original domain (which presumably I don't control).
Does that make sense?
It's an open standard, so you can read all about it: https://webauthn.guide/
Seems like good password manager hygiene (which checks the domain name before filling credentials) can help prevent this from happening.
Unless it doesn't auto-fill, but it looks right, so you paste it anyway.